mitigate web application vulnerabilities and attacks

injection attack

occurs when the attacker inserts malicious code through an application interface

directory traversal

an application attack that allows access to commands, files, and directories that may or may not be connected to the web document root directory

../../../../

file inclusion

a web application vulnerability that allows an attacker either to download a file from an arbitrary location on the host file system or to upload an executable or script file to open a backdoor

remote file inclusion

an attacker executes a script to inject a remote file into the web app or website

local file inclusion

an attacker adds a file to the web app or website that already exists on the hosting server

cross site scripting(XSS)

a malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser’s security model of trusted zones

• a powerful input validation exploit

• XSS breaks the browser’s security model since browsers assume scripting is safe

persistent XSS

an attack that inserts code into a back-end database used by the trusted site

server side scripting attacks

reflected, non-persistent, and persistent XSS attacks occur as server-side scripting attacks

document object model(DOM) XSS

L)an attack that exploits the client’s web browser using client side scripts to modify the content and layout of a web page

structured query language(SQL)

used to select, insert, delete, or update data within a database

injection attack

insertion of additional information or code through data input from a client to an application

SQL injection

attack consisting of the insertion or injection of an SQL query via input data from the client to a web application

• prevented through input validation and using least privilege when accessing a database

• a common technique in SQL injection is to insert a statement that is always true, such as 1==1

insecure object reference

coding vulnerability where unvalidated input is used to select a resource object like a file or database

XML bomb(billion laughs attack)

XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it

XML external entity(XXE)

an attack that embeds a request for a local resource

input validation

any technique used to ensure the data enterred into a field or variable in an application is handled appropriately by that application

• can be conducted locally(on client) or remotely(on server)

• WARNING: client side input validation is more dangerous since it is vulnerable to malware interference

• input should still undergo server-side validation after passing client-side validation

normalization

a string is stripped of illegal characters or substrings and converted to the accepted character set

canonicalization attack

attack method where input characters are encoded in such a way as to evade vulnerable input validation measures

output encoding

a coding method to sanitize output by converting untrusted input into a safe form where the input is displayed as data to the user without executing as code in the browser

• output encoding mitigates against code injection and XSS attacks that attempt to use input to run a script

parameterized queries

a technique that defends against SQL injection and insecure object references by incorporating placeholders in an SQL query

spoofing

software based attack where the goal is to assume the identity of a user, process, address, or other unique identifier

on-path attack

an attack where the attacker sits between two communicating hosts and captures, monitors, and relays all communication between the hosts

variation of this attack: man in the browser(MitB), is an attack that intercepts API calls between the browser process and its DLLs

password spraying

brute force attack in which multiple user accounts are tested with a dictionary of common passwords

credential stuffing

brute force attack in which stolen user account names and passwords are tested against multiple websites

broken authentication

a software vulnerability where the authentication mechanism allows an attacker to gain entry

session management

enables web applications to uniquely identify a user across a number of different actions and requests, while keeping the state of the data generated by the user and ensuring it is assigned to that user

cookie

text file that is used to store information about a user when they visit a website

• session cookies are non-persistent, reside in memory, and are deleted when the browser instance is closes

persistent cookies

cookies that are stored in the browser cache until they are deleted by the user or pass a defined expiration date

session hijacking

a type of spoofing attack where the attacker disconnects a host then replaces it with their own machine, spoofing the original host’s IP address

• session hijacking attacks can occur through the theft or modification of cookies

session predicition attack

a type of spoofing attack where the attacker attempts to predict the session token to hijack a session

cross site request forgery(XSRF/CSRF)

a malicious script hosted on the attacker’s site that can exploit a session started on another site in the same browser

cookie poisoning

modifies the contents of a cookie after it has been generated and sent by the web service to the client’s browser so that the newly modified cookie can be used to exploit vulnerabilities in the web app

server side request forrgery(SSRF)

a type of cyber attack in which an attacker is able to send a request on behalf of a web application

• considered a critical threat that faces today’s modern web applications

web application firewall

used to detect and block SSRF attacks

sensitive data exposure

a software vulnerability where an attacker is able to circumvent access controls and retrieve confidential or sensitive data from the file system or database

clickjacking

a type of hijacking attack that forces a user to unintentionally click a link that is embedded in or hidden by other web page elements

• clickjacking is made possible due to iframes within HTML

• frame busting is a technique that removes the malicious iframe loaded on a site by forcing a page to the top frame

tony works for a company as a cybersecurity analyst. his company runs a website that allows public postings. recently, users have started complaining about the website having pop-up messages asking for their username and password. simultaneously, your security team has noticed there has been a large increase in the number of compromised user accounts on the system. what type of attack is most likely the cause of both of these events?

this scenario is a perfect example of the effects of a cross-site scripting(XSS) attack. if your website’s HTML code does not perform input validation to remove scripts that may be entered by a user, then an attacker can create a pop-up window that collects passwords and uses that information to further compromise other accounts.